Search papers, labs, and topics across Lattice.
This paper validates the use of a taxonomy-aware penalty from the ALPHA benchmark as a training signal for CWE-level vulnerability prediction in Python. Through comparisons of supervised fine-tuning, dual-head classification loss, and reinforcement learning with a dense reward, the authors demonstrate that the GRPO method outperforms traditional supervised approaches, particularly under distribution shifts. The best-performing policy significantly reduces the cumulative ALPHA penalty on the SVEN dataset, achieving statistical parity with a much larger zero-shot model.
GRPO's hierarchical penalty reduces vulnerability prediction errors by nearly 28%, outperforming larger models under challenging conditions.
The original ALPHA benchmark introduced a taxonomy-aware penalty for evaluating CWE-level vulnerability prediction in Python and proposed that the penalty could theoretically also serve as a training signal. This paper provides that validation. We compare three delivery mechanisms: supervised fine-tuning, a dual-head classification loss, and reinforcement learning with a dense reward derived from the normalised penalty. We find that supervised approaches consistently regress below the zero-shot baseline under distribution shift, while GRPO succeeds. Our best policy reduces the cumulative ALPHA penalty of Qwen2.5-Coder-7B on Security Hardening and Adversarial Testing (SVEN) dataset by 27.9% under greedy decoding, and by 25.5% under sampled decoding(p = 0.005, Welch's t-test), reaching statistical parity with its 4.5x larger zero-shot teacher. We conclude that the value of a hierarchical penalty as a training signal depends largely on the directness of its delivery.
